Gather Victim Network Information
Network-information gathering collects details about an organization's network footprint.
What it means
Network-information gathering collects details about an organization's network footprint. Public technical data can reveal likely services without direct access to internal systems.
MITRE ATT&CK catalogs this behavior as T1590, within reconnaissance. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.
An investigation example
A campaign's targeting corresponds to internet-visible address ranges and domains associated with the organization.
Evidence to examine
Review public footprint, observed probes, domain relationships, and the specific services contacted.
A common analytical pitfall
Public knowledge of an address does not prove internal access or that the identified service is exploitable.
Response considerations
Maintain an accurate external inventory and prioritize protection of confirmed exposed services rather than assuming obscurity prevents targeting.
Network observations are partial views
A fictional supplier exposes a public service under several hostnames. DNS and routing information can reveal relationships useful for targeting, but an external view does not necessarily show the complete internal topology. Shared providers and changing address assignments complicate the interpretation. Treat each observation as a dated view of a specific source.
Different facts answer different questions. A domain-to-address relationship indicates a resolution result at a time; a routing announcement concerns reachability of a network prefix; a discovered service concerns behavior from a particular vantage point. Combining them can be useful, but one should not silently substitute for another.
Defenders should compare external observations with owned inventories. An unexpected hostname might be an abandoned deployment, a legitimate vendor integration, or stale historical data. Assign an owner and verify the current state before deciding on removal or blocking. Broad blocking based on shared infrastructure can disrupt unrelated legitimate services.
Make a relationship map with confidence labels
Use fictional domains and documentation addresses to draw a supplier's public service, hosting provider, and partner integration. Mark which links are confirmed current facts and which are hypotheses. Add a historical address and explain why it should not be treated as current ownership.
The exercise should produce questions for authorized validation, not an unauthorized probing plan. In an investigation, correlate network context with observed delivery, connection, and endpoint evidence. Network-information gathering can support an adversary's preparation, but it does not prove exploitation or identify an actor. A good report preserves source, time, scope, and uncertainty so later analysts can evaluate the relationships rather than inherit unsupported assumptions.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1590: Gather Victim Network Information